Exactly the same as with a 6-digit passcode.
People seem to have a fundamental misunderstanding of what odds signify, and the practical application of odds to determine the probability of an event actually occurring.
First, the 1:1,000,000 odds are the odds of two people having the same facial features--not the odds of randomly holding up the phone to anyone in the general population and hoping it unlocks. In other words, it is not the equivalent of guessing a passcode.
Why does this matter? With FaceID you also narrow the odds significantly by starting with an identical twin (or in this case brothers that look almost exactly alike). The phone allows 5 attempts. Under those circumstances it's almost certain that the phone will unlock.
Conversely, if Obama and Trump both had iPhone Xs, the odds of them being able to unlock each other's phones via FaceID is zero.
Similarly, with a passcode, the practical application is what matters, not the sheer odds. If one could attempt to enter the passcode any number of times, the phone will eventually unlock by brute force. The odds are not relevant. What is relevant is the 10 attempts limitation, which results in odds of 1:100,000 that someone may guess correctly.